Executive brief
A vulnerability in the Linux kernel's networking component could allow a local attacker to access sensitive information from the system's memory. The issue occurs when the system incorrectly processes certain network packets, potentially leading to a disclosure of data from the kernel's internal storage (heap). This could compromise the confidentiality of system operations or user data.
Technical details
A vulnerability exists in the Linux kernel's net/socket.c where skb_is_err_queue() incorrectly identifies certain AF_PACKET skbs as error queue entries based solely on the PACKET_OUTGOING marker. When SO_RXQ_OVFL and timestamping are enabled, the kernel may misinterpret AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. This confusion allows an attacker to trigger an out-of-bounds read in non-linear skbs, leading to a disclosure of adjacent heap contents or triggering hardened usercopy protections. The fix involves updating skb_is_err_queue() to verify both the PACKET_OUTGOING marker and the sock_rmem_free destructor.
Affected products
- Linux Linux Kernel 8605330aac5a5785630aec8f64378a54891937cc to 1ee90b77b727df903033db873c75caac5c27ec98
Timeline
- 2026-06-25: advisory: CVE-2026-53223 published by NVD
- 2026-06-09: patched: Mainline kernel patch committed
References
- https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98
- https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3
- https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31
- https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe
- https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4
- https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060
- https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797